Splunk Search
Highlighted

How do I make a field value as a column heading?

Communicator

I would like to display weekday in the column heading.

|Search....
| eval weekday=strftime(now(),"%A")

Output

S.no    | Daily          | weekday
  1        101             Thursday
  2        210             Thursday

Desired Output

S.no    | Daily (Thursday)
  1        101             
  2        210             

Tried xyseries and transpose but I couldn't find a way to flip only one column instead of the whole table.

0 Karma
Highlighted

Re: How do I make a field value as a column heading?

Influencer

you can use this in your first search, you can replace sno column name by Daily as per your query.

eval weekday=strftime(now(),"%A")|eval column_name=sno| eval sno ( {weekday} )= sno

Highlighted

Re: How do I make a field value as a column heading?

SplunkTrust
SplunkTrust

@ibob0304,

This works for me,

|Search....
|eval weekday=strftime(now(),"%A")|eval Daily({weekday})=Daily|fields - Daily,weekday

View solution in original post

Highlighted

Re: How do I make a field value as a column heading?

@ibob

| makeresults |eval weekday=strftime(now(),"%A") |eval value=100 |fields - _time | transpose header_field="weekday"